Virtualization is a term that has been coined to refer to the abstraction of computer resources. This includes abstraction of both hardware and software at multiple levels, from individual servers and clients to complete networks. In this latter instance, the term “virtual infrastructure” has been used to refer to abstracted resources of a computer network, inclusive of all the hardware and software.
While virtualization provides many benefits, it also poses several new security risks, including the potential for unauthorized access of resources or data, denial of service attacks through starving of resources, and “hyperjacking”, in which hypervisors (software layers that abstract physical hardware resources from the virtual machines running thereon) are compromised. These and other risks demand that virtualized resources be placed under the control of stringent security facilities.
In the above-cited U.S. patent application Ser. No. 12/210,084 (the “'084 application), a control layer that securely manages the configurations of virtualization platforms was introduced. These configurations were based on published best practices and/or security hardening guidelines, such as the VMware Security Hardening Best Practice for VMware Infrastructure 3, CIS VMware ESX Server 3.x Benchmark, and the NSA VMware ESX Server 3 Configuration Guide. The assessments and remediations performed by the control layer were primarily based on these publications, however, administrators were still allowed to customize, and either make more stringent or relax how securely the deployed virtualization platforms were configured.
Thus, the configuration practices adopted in the '084 application relied on “static” knowledge; that is, knowledge derived from past experiences, mandates and recommendations of the administrators and other individuals. Although such a protocol provides substantial savings in terms of time, cost and consistency, the overall benefits are limited in that the protocol mirrors only what is already known. The virtualization platforms can be quickly and consistently configured to meet particular security and compliance requirements, as published in these benchmarks/best practices, but that is all. We call such a solution the “static knowledge configuration management system” or ARC.
A further related patent application, U.S. patent application Ser. No. 12/347,315, filed Dec. 31, 2008 (the “'315 application”), assigned to the assignee of the present invention and incorporated herein by reference, describes a security control system adapted to define and analyze object handling control information, for example, control information that may influence or impact security and compliance of a virtualized ecosystem and derive from it object properties for each of a number of logical resources involved in the execution of a virtual machine in any given context within the virtualized ecosystem. While ARC provides many beneficial methods and systems for managing virtualization platforms, the present inventors have determined that even greater benefits can be obtained through the use of an adaptive configuration and security control management system (ACMS) for a virtualized ecosystem such as that discussed in the '315 application. This ACMS is discussed in detail below.